470bb3b5e43e3beee4472fc7f57615ad76452fa6ed23fddb4b2d9bd79c7d4ea1
- SHA256 470bb3b5e43e3beee4472fc7f57615ad76452fa6ed23fddb4b2d9bd79c7d4ea1
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
yteedj.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
yteedj.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target 470bb3b5e43e3beee4472fc7f57615ad76452fa6ed23fddb4b2d9bd79c7d4ea1
- Size 2.1MB
- Sample260924-e647raea87
- SHA256 470bb3b5e43e3beee4472fc7f57615ad76452fa6ed23fddb4b2d9bd79c7d4ea1
- MD5 324bbbbeea0867c69f8eec6174d67ced
- SHA1 ac2344c0ba0713e1f25a242ffb5ee5ca3f83872e
- SHA512 2541419a2987c53d42da1899e6965a6aa42e7439655fc56c5f6c3c80165ec89cb1346977d1358fe020e45b718c977235623acc57a9606cd22f7110286f419ea3
- SSDEEP 49152:bJWd44tLozriyw7snJLhm942XYkwyJE9o9yMXJ56g73jb9o:bh4tMz2PsnP9g4Mr6sho
- TLSH T17BA533BA91ECFB69C01517EDC7CD4BF1278B8AC123DF08516E7DA168009FA91AD3186D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/yteedj.sys
File Explorer
-
470bb3b5e43e3beee4472fc7f57615ad76452fa6ed23fddb4b2d9bd79c7d4ea1.zip 2.1MB
-
yteedj.sys.sys 2.2MB
yteedj.sys
- IMPHASH 881e9a3c2c87702a0cd51e14eae5e479
- SHA256 1900e8362353fc8709da7deb3ca8c1dc009754999c362a0ed8fea9333667bc0f
- MD5 c7dad6904c5d6a3a03108a5672e450fe
- SHA1 af59584c1b5d313bc9cb61d965843611e4ead979
- SHA512 fde2b1f0f82de79ff2058d2640e6aa410762bc020bd0fb5486ff1e216e721a27d53e268365dccc60b0a7ffff551b9fbd8df8c21da35c5c272347dde0170589d9
- SSDEEP 49152:p9ytOxdkxlCcwBsBVbLE9OEFm6QWnYh6f9X2NhVVMmQ:p7nkxgfsBpj+VXmcn
- TLSH T18CB5229929C125BDC0A2C7F483C7B4BD717B77805AA78CD73ADE2D604E62604B63364E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
73:b2:29:a1:78:d2:c6:86:e2:58:64:02:f5:2c:0f:73:4e:fc:46:89:93:6f:20:d9:5e:a4:4b:40:00:f5:e6:39
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Beijing Datang Shenzhou Technology Co.\, Ltd.,O=Beijing Datang Shenzhou Technology Co.\, Ltd.,L=北京,ST=北京,C=CN
Chains
Sep 23, 2026
CN=Beijing Datang Shenzhou Technology Co.\, Ltd.,O=Beijing Datang Shenzhou Technology Co.\, Ltd.,L=北京,ST=北京,C=CN
CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US
PE Signature issue
Digest
54:3f:8e:8a:b1:8c:9c:ff:e2:c7:ea:93:98:df:27:e3:ff:da:a7:c6
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Beijing Datang Shenzhou Technology Co.\, Ltd.,O=Beijing Datang Shenzhou Technology Co.\, Ltd.,L=北京,ST=北京,C=CN
Chains
Sep 23, 2026
CN=Beijing Datang Shenzhou Technology Co.\, Ltd.,O=Beijing Datang Shenzhou Technology Co.\, Ltd.,L=北京,ST=北京,C=CN
CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US
Subject
CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US
Serial Number
47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Subject
CN=Beijing Datang Shenzhou Technology Co.\, Ltd.,O=Beijing Datang Shenzhou Technology Co.\, Ltd.,L=北京,ST=北京,C=CN
Serial Number
19:0f:45:7e:1b:e3:3a:f8:cd:43:29:da:9e:26:8e:21
Issuer
CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning
Revocation Status
Not revoked
Timespan
Dec 11, 2014 - Dec 10, 2016
Subject
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Serial Number
61:1f:b0:a4:00:00:00:00:00:1d
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Minor OS version
1
Major OS version
6
Entry point
3898638
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ntoskrnl.exe
KeInitializeEvent
NtQuerySystemInformation
ExAllocatePool
IoAllocateMdl
ExFreePoolWithTag
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
KeQueryActiveProcessors
KeSetSystemAffinityThread
KeRevertToUserAffinityThread
DbgPrint
fltmgr.sys
FltStartFiltering
hal
KeQueryPerformanceCounter
Name
.text
Size
Virtual Size
204KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
338KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vOK
Size
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.HZ2
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.^X(
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
196B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ